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Abstract 

THE  WHO,  WHAT  AND  HOW  OF  SOCIAL  MEDIA  EXPLOITATION  FOR  A  COMBATANT 
COMMANDER  (CCDR) 

In  phase  zero,  the  CCDR’s  intelligence  directorate  (J2)  should  exploit  social  media  to  enhance 
understanding  of  a  state’s  population,  part  of  factor  space,  to  better  forecast  a  state’s  level  of 
stability.  The  expansion  of  social  media  platforms  and  devices  that  allow  easy  access  to  these 
platforms  have  created  a  new  source  of  intelligence  information.  Social  media  platforms  such  as 
Facebook,  Twitter  and  YouTube  provide  users  with  the  ability  to  create,  disseminate,  share  and 
access  information  from  almost  anywhere  in  the  world  in  real  time,  on  any  subject  one  may  have 
an  interest.  The  recent  revolution  in  Egypt  demonstrates  how  social  media  platforms  were  used 
to  plan  and  direct  the  protests  that  led  to  the  downfall  of  President  Mubarak.  The  Egyptian  case 
highlights  important  observations  on  how  a  CCDR  and  his  J2  can  best  exploit  social  media 
platforms.  In  order  to  exploit  social  media  the  J2  must  build  a  robust  JIPOE  on  social  media 
platforms  to  identify  the  platforms  that  people  in  a  country  of  interest  use.  The  J2  must  identify 
PIRs  and  warning  indicators  that  social  media  can  answer.  A  robust  collection  plan  must  be 
designed,  as  well  as  a  strategy  for  exploitation  of  social  media.  Finally,  the  exploited  information 
needs  to  be  analyzed  in  order  to  answer  PIRs  or  warning  indicators.  Social  media  is  an  untapped 
intelligence  source.  A  well  planned  collection  strategy  will  enable  a  CCDR  to  effectively  exploit 
social  media,  helping  to  better  understand  a  state’s  security  conditions. 


Introduction 

In  early  2011,  the  Arab  world  underwent  drastic  upheaval  as  protest  movements  spread 
from  country  to  country  resulting  in  the  downfall  of  governments  in  Egypt,  Tunisia,  and  Libya 
and  causing  instability  in  Syria,  Bahrain  and  other  Arab  states.  Dubbed  the  “Arab  Spring,”  the 
mass  protests  were  primarily  a  people’s  movement  that  were  partly  organized  and  driven  through 
the  use  of  social  media. 1  For  example,  Egyptian  protesters  used  social  media  to  organize  protests 
and  to  maintain  the  momentum  of  the  protest  movement  through  the  spread  of  information  on  the 
Egyptian  regime’s  harsh  response  to  the  protests."  The  Arab  Spring  demonstrates  how  the 
exploitation  and  analysis  of  social  media  can  be  used  to  assess  the  security  situation  within  a 
country.  Thus,  as  social  media  continues  to  proliferate  as  a  means  of  communication,  a 
Combatant  Commander  (CCDR)  needs  to  understand  the  importance  and  usage  of  social  media 
within  his  area  of  operations  (AOR)  to  anticipate  changes  in  the  security  environment. 
Specifically,  in  phase  zero,  the  CCDR’s  intelligence  directorate  (J2)  should  exploit  social  media 
to  enhance  understanding  of  a  state’s  population,  part  of  factor  space,  to  better  forecast  a  state’s 
level  of  stability. 

Using  the  Egyptian  protest  as  a  case  study,  this  paper  will  explore  how  the  J2  can 
effectively  integrate  social  media  exploitation  into  a  phase  zero  joint  intelligence  preparation  of 
the  operating  environment  (JIPOE).  First,  the  paper  will  define  social  media  and  discuss  social 
media  platforms.  Second,  the  paper  will  examine  the  Egyptian  protests  to  understand  the  use  of 
social  media  and  why  a  CCDR  should  focus  on  it.  This  section  will  also  offer  observations  that  a 
J2  should  be  aware  of  when  exploiting  social  media.  Finally,  the  paper  will  explore  how  the  J2 

1  Jurgen  Pfeffer  and  Kathleen  M.  Carley,  “Social  Networks,  Social  Media,  Social  Change,”  In  proceedings  of  the  2nd  International  Conference 
on  Cross-Cultural  Decision  Making:  Focus  2012,  San  Francisco,  CA,  July  21-25,  2012,  accessed  22  April  2013, 
http://www.casos.cs.cmu.edu/publications/papers/2012SocialNetworksSocialMediaSocialChange.pdf. 

2  Zeynep  Tufekci  and  Christopher  Wilson,  “Social  Media  and  the  Decision  to  Participate  in  Political  Protest:  Observations  From  Tahrir  Square,” 
Journal  of  Communication,  Volume  62,  Issue  2  (March  6,  2012),  accessed  25  April  2013,  http://onlinelibrary.wiley.eom/doi/10.llll/j.  1460- 
2466.201 2.0 1629.x/pdf. 
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can  integrate  social  media  information  into  JIPOE,  specifically  in  an  indications  and  warning 
(I&W)  system  used  during  phase  zero. 

Before  continuing  it  is  necessary  to  define  the  term  stability  since  it  is  used  throughout 
the  paper.  According  to  Merriam- Webster  online  dictionary  the  term  ‘stable’  is  defined  as 
“firmly  established;  not  changing  or  fluctuating;  permanent,  enduring.”'  Therefore,  when  a  state 
faces  instability,  changes  are  occurring  that  alter  the  status  quo,  possibly  affecting  the  security 
environment.  Instability  may  also  encapsulate  political  factors  such  as  the  increase  in 
protests/civil  disobedience  and  crackdown  on  opposition  political  parties,  economic  factors  such 
as  resource  shortages  or  rapid  inflation,  and/or  social  factors  such  as  repression  against  minority 
groups.  The  paper  will  argue  that  social  media  can  be  exploited  to  better  understand  instability 
factors. 

Caution 

However,  before  CCDRs  abandon  traditional  intelligence  sources  and  fully  integrate 
social  media  into  JIPOE,  several  attributes  of  social  media  need  to  be  understood  to  comprehend 
its  limitations  in  providing  an  accurate  picture  of  the  operating  environment.  These  attributes 
include  who  uses  social  media,  the  availability  of  social  media,  and  the  actual  impact  of  social 
media  in  translating  words  into  actions. 

First,  users  of  social  media  are  not  uniform  from  country  to  country  or  even  within  a 

specific  country.  According  to  a  2012  Pew  Research  study  on  the  social  media  use  in  the  U.S: 

Internet  users  under  50  are  particularly  likely  to  use  a  social  networking  site  of  any  kind, 
and  those  18-29  are  the  most  likely  of  any  demographic  cohort  to  do  so  (83%).  Women 
are  more  likely  than  men  to  be  on  these  sites.  Those  living  in  urban  settings  are  also 
significantly  more  likely  than  rural  internet  users  to  use  social  networking.3 4 


3  Merriam-Webster  Online  Dictionary,  s.v.  “stable,”  accessed  May  11  2013. 

4  Maeve  Duggan  and  Joanna  Brenner,  “The  Demographics  of  Social  Media  Users  -  2012,”  Pew  Internet  and  American  Life  Project,  Pew 
Research  Center,  February  14,  2013,  accessed  26  April  2013,  http://pewintemet.org/Reports/2013/Social-media-users.aspx. 
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While  this  data  is  based  on  the  population  of  the  United  States,  similar  observations  have  been 


made  worldwide;  users  of  social  media  tend  to  be  young  people  under  the  age  of  30.  Older 
individuals’  lack  of  usage  excludes  a  significant  portion  of  a  country’s  population.  Omand, 
Bartlett  and  Miller,  intelligence  analysts  who  write  about  the  use  of  social  media,  identify  this  as 
a  major  problem  of  social  media  analysis  since  “when  people  are  absent  from  a  data  set  for  a 
reason  other  than  chance,  they  share  a  related  and  likely  important  trait(s)  that  could  have  a 
substantial  impact  on  research  findings.”5  The  non-usage  of  social  media  by  a  large  portion  of  a 
population  reduces  the  certainty  of  assessing  stability  factors  and  may  give  a  false  reading  if  only 
relying  on  social  media.  However,  in  the  future,  today’s  young  social  media  users  will  begin  to 
move  into  positions  of  power  and  influence;  thus  the  value  of  social  media  in  understanding 
stability  will  likely  increase.  Moreover,  as  seen  in  Egypt,  the  impact  of  social  media  will  magnify 
if  youth  have  the  ability  to  destabilize  a  government  through  mass  protests. 

In  addition  to  age  divisions,  each  country  has  a  different  level  of  social  media  usage. 
According  to  the  Arab  Social  Media  Report,  Facebook  usage  in  the  Arab  world  was 
approximately  12%  of  the  population  in  2012.  However,  when  broken  down  by  country  Turkey 
has  the  highest  population  of  Facebook  users  at  1.02  million,  while  Iraq,  a  less  stable  country, 
only  has  39,000  users.6  The  lack  of  usage  in  Iraq  should  cause  the  J2  to  downplay  the 
significance  of  Facebook  in  the  stability  assessment  for  Iraq,  while  it  might  be  a  significant 
factor  when  analyzing  Turkey’s  stability.  The  varying  levels  of  use  in  countries  of  interest  should 
caution  CCDR’s  from  relying  too  heavily  on  social  media  data  when  assessing  a  country’s 
stability.  However,  despite  today’s  low  usage  in  some  countries,  this  should  not  cause  the  J2  to 


5  David  Omand,  Jamie  Bartlett,  and  Carl  Miller,  "Introducing  Social  Media  Intelligence  (SOCMINT),"  Intelligence  &  National  Security,  27,  no.  6 
(2012):  809,  accessed  March  12,  2013,  http://search.proquest.com/docview/1239085575?accountid=322. 

6  Arab  Social  Media  Report,  Dubai  School  of  Government's  Governance  and  Innovation  Program,  accessed  April  26,  2013, 
http://www.arabsocialmediareport.com/Facebook/LineChart.aspx?&PriMenuID=18&CatID=24&mnu=Cat. 
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ignore  the  importance  of  social  media  in  future  analysis.  For  example,  from  June  201 1  to  June 
2012  Arab  countries  saw  Facebook  usage  increase  50%,  highlighting  how  fast  usage  is 

7 

increasing,  a  rate  that  is  likely  to  continue. 

The  final  caution  with  using  social  media  as  a  source  to  measure  stability  is  that  words  do 
not  always  translate  into  actions.  Anthony  Olcott,  an  intelligence  expert  on  the  use  of  open 
source  information,  cautions  analysts  that  while  they  may  understand  the  message,  predicting  the 

o 

effect  of  that  message  is  a  challenge.  A  message  may  be  clear  and  concise,  but  the  impact  of  that 
message  on  the  population  may  be  different  than  expected.  A  message  may  proliferate  to  a  wide 
audience  on  social  media  such  as  calling  for  protests,  however  the  actual  individuals  who  join  the 
protest  may  be  minimal.  The  J2  must  be  cautious  in  taking  social  media  at  face  value  and  must 
balance  it  with  other  intelligence  sources.  Despite  this  caution,  words  without  actions  are  not 
always  useless.  The  use  of  social  media  during  the  London  riots  of  201 1  did  not  necessarily  lead 
to  more  widespread  protests,  but  it  allowed  the  police  to  receive  real  time  reports  of  ongoing 
activity  allowing  them  to  adjust  their  response.9  The  reporting  ability  of  social  media  can  provide 
the  J2  with  a  better  view  of  a  situation  leading  to  a  better  assessment. 

With  these  caveats  in  mind,  a  CCDR  must  integrate  social  media  into  his  stability 
assessment  as  its  use  continues  to  proliferate  and  becomes  more  important  for  communication. 
The  rest  of  paper  will  explore  how  a  CCDR  and  J2  should  exploit  social  media  to  better  assess 
stability. 

What  is  Social  Media? 

The  official  Department  of  Defense  (DoD)  dictionary  does  not  define  social  media;  thus 
it  is  useful  to  define  it  in  the  context  of  this  paper.  Gupta  and  Brooks,  analysts  who  specialize  in 

7  Ibid. 

s  Anthony  Olcott.  Open  Source  Intelligence  in  a  Networked  World  (London  and  New  York:  Continuum.  2012),  198. 

9  David  Omand  et  al.  "Introducing  Social  Media  Intelligence  (SOCMINT),"  802. 
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the  use  of  social  media  to  address  security  issues,  offer  a  useful  definition  of  social  media 
emphasizing  two  key  attributes,  devices  and  platforms.  They  define  social  media  as  “devices  and 
platforms  that  allow  users  to  create  and  share  information  with  each  other.”10  Devices  are 
necessary  to  access  social  media  information.  Initially,  devices  were  limited  to  an  internet 
connected  computer,  but  with  the  mass  proliferation  of  smart  phones  people  are  now  able  to 
access  social  media  from  almost  anywhere.  In  2012,  46%  of  all  US  social  media  users  accessed 
social  media  via  smartphones,  a  jump  from  37%  in  2011,  another  trend  that  continues 
worldwide.11 

Gupta  and  Brooks  define  platforms  as  “the  virtual  spaces  that  allow  users  to  come 
together,  and  create  and  share  information.”  “  While  understanding  devices  assists  the  J2  in 
understanding  how  people  access  information,  platforms  are  the  medium  where  people  interact; 
creating,  sharing  and  exchanging  information.  Thus,  the  J2  should  focus  on  exploiting  platforms. 

Platforms  can  be  divided  into  several  categories;  the  two  most  common  are  social 
networking  platforms  and  media  platforms.  Social  networking  platforms  emphasize  relationships 
and  networks.  The  most  popular  platforms  include  Facebook,  Twitter,  and  Linkedln.  For 
example,  in  March  2012  Egypt  had  215,000  active  Twitter  users  who  sent  630,000  tweets.  These 
numbers  continue  to  increase  with  Arabic  becoming  the  fastest  growing  language  in  Twitter 
history  (English  being  the  primary  language).14  Additionally,  each  country  or  region  has  its  own 
unique  social  network.  The  top  social  network  site  in  Russia  is  called  VKontakte,  while 
Facebook  is  the  seventh  most  popular  social  network  site.15  A  J2  must  be  aware  of  these  local, 


10  Ravi  Gupta  and  Hugh  Brooks,  Using  Social  Media  for  Global  Security  (Indianapolis,  IN:  John  Wiley  &  Sons,  2013),  18. 

11  Neilson  Company,  State  of  the  Media:  The  Social  Media  Report  2012,  accessed  26  April,  2013, 
http://www.nielsen.com/us/en/reports/2012/state-of-the-media-the-social-media-report-2012.html. 

12  Gupta,  Using  Social  Media  for  Global  Security,  18. 

13  Ibid.,  22-23. 

14  Arab  Social  Media  Report. 

15  Comscore,  “Russia  has  the  World’s  Most  Engaged  Social  Networking  Audience,”  Comscore  Insights  Press  Releases,  July  2,  2009,  accessed 
April  27,  2013,  http://www.comscore.eom/Insights/Press_Releases/2009/7/Russia_has_World_s_Most_Engaged_Social_Networking_Audience. 
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national  or  language  specific  social  networks  since  a  large  percentage  of  the  population  may 
operate  on  a  platform  that  is  unfamiliar  in  the  U.S. 

The  next  category  is  media  platforms,  which  enable  users  to  create  and  share  media  with 
others.  YouTube,  Flickr,  and  Instagram  are  some  of  the  most  well-known  sites.16  YouTube,  a 
site  that  allows  users  to  post  videos,  is  the  most  popular  with  1  billion  unique  visitors  each 
month.  Videos  include  political  commentary,  captured  video  of  real  time  newsworthy  events 
and  homemade  movies  that  have  varying  levels  of  production  quality.  YouTube  is  a  worldwide 

i  o 

phenomenon  with  70%  of  its  traffic  originating  from  outside  the  US.  YouTube  is  most  often 
used  for  entertainment  purposes,  but  as  seen  during  the  Arab  Spring  protests  the  site  was  used  to 
disseminate  real  time  video  of  political  events.  Videos  shot  with  the  protestors’  smartphones  and 
posted  on  YouTube  allowed  the  world  to  get  a  first  person  view  of  what  was  happening  on  the 
ground.19  When  combined  with  other  intelligence  sources,  media  platforms  can  provide 
additional  insight  on  a  developing  situation  helping  to  understand  what  is  occurring  in  a  given 
country.  Finally,  similar  to  social  networking  sites,  media  platforms  are  often  unique  to  each 
country. 

With  a  good  understanding  of  the  definition  of  social  media  and  an  understanding  of  the 
platforms  that  people  use  to  interact,  it  is  now  time  to  examine  why  a  J2  might  find  this 
information  useful. 

Why  Social  Media?  -  Tahrir  Square  Case 

An  examination  of  the  Egyptian  uprising  in  the  winter  of  201 1  highlights  why  a  CCDR 
should  exploit  social  media  during  phase  zero.  This  case  illustrates  how  the  protestors  used 

16  Gupta,  Using  Social  Media  for  Global  Security.  24-25. 

17  YouTube  Statistics,  YouTube,  accessed  April  27,  2013,  http://www.youtube.com/yt/press/statistics.html. 

18  Ibid. 

19  Philip  N.  Howard,  Aiden  Duffy,  Deen  Freelon,  Muzammil  Hussain,  Will  Mari,  Marwa  Mazaid,  “Opening  Closed  Regimes:  What  Was  the  Role 
of  Social  Media  During  the  Arab  Spring?”,  Project  on  Information  Technology  and  Political  Islam,  University  of  Washington,  September  1 1, 
2011,  accessed  May  12,  2013,  http://pitpi.org/wp-content/uploads/2013/02/2011_Howard-Duffy-Freelon-Hussain-Mari-Mazaid_pITPI.pdf. 
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social  media  to  facilitate  the  toppling  of  the  Egyptian  regime.  While  many  analysts  argue  that 
social  media  was  not  the  primary  cause  of  Egyptian  President  Hosni  Mubarak's  fall  from 
power"  ,  the  protesters  use  of  social  media  should  not  be  ignored.  In  order  to  examine  the  impact 
of  social  media  on  the  Egyptian  revolution  this  paper  offers  a  brief  overview  of  events  while 
examining  how  social  media  was  employed  during  the  revolution.  Finally,  the  paper  will  detail 
observations  a  J2  should  leam  from  this  case. 

Throughout  the  revolt,  social  media  played  a  major  role.  First,  the  death  of  Khalid  Said, 
an  Egyptian  brutally  beaten  to  death  by  Egyptian  police,  came  to  the  attention  of  Egyptian  Wael 
Ghonim  while  surfing  Facebook  from  his  office  in  Dubai.  The  horrific  pictures  of  Khalid  Said’s 
dead  body  prompted  Ghomin  to  create  a  Facebook  page  to  highlight  Egyptian  police  brutality.  In 
the  subsequent  months  over  250,000  followers  joined  his  page,  which  soon  transitioned  into  a 
forum  that  captured  the  frustration  of  living  in  an  Egyptian  police  state."  In  early  January, 

inspired  by  the  recent  revolt  in  Tunisia,  Ghomin’s  Facebook  page  and  other  social  media  sites 

22 

called  for  protests  against  President  Mubarak’s  regime,  a  call  that  thousands  answered." 

On  January  25,  2011,  the  protesters  held  their  first  major  protest.  Over  the  next  eighteen 
days  several  hundred  thousand  Egyptians  marched  in  Cairo  and  other  Egyptian  cities  protesting 
the  regime."  The  Egyptian  authorities  used  threats,  negotiation  tactics  and  tried  to  force  an  end 
to  the  protests,  however  they  were  unable  to  halt  the  protest’s  momentum.  Finally,  on  February 

24 

11  2011,  President  Mubarak  agreed  to  step  down  from  power." 

20  Blake  Hounshell,  “Think  Again  Egypt,”  Foreign  Policy,  February  14,  201 1,  accessed  April  24,  2013. 
http  ://w  w  w.foreignpolicy .  com/  articles/20 1 1/02/ 1 4/think_again_egypt . 

21  Jennifer  Preston,  “Movement  Began  with  Outrage  and  Facebook  Page  That  Gave  it  an  Outlet,”  New  York  Times,  February  6,  2011,  accessed 
April  24,  2013,  http://www.nytimes.com/201  l/02/06/world/middleeast/06face.html?pagewanted=print. 

22  Josen  Antonio  Vargas,  “Spring  Awakening:  How  an  Egyptian  Revolution  Began  on  Facebook,”  New  York  Times,  February  17,  2012,  accessed 
April  24,  2013.  http://www.nytimes.com/2012/02/19/books/review/how-an-egyptian-revolution-began-on-facebook.html?pagewanted=all. 

23  Christian  Science  Monitor  Online,  “Timeline  of  Egyptian  Revolution,”  June  22,  2012,  accessed  April  26,  2013, 
http://www.csmonitor.com/World/Middle-East/2012/0622/Timeline-Egypt-s-revolution. 

24  BBC  News,  “Profile  Hosni  Mubarak,”  last  updated  April  13,  2013,  accessed  April  24,  2013,  http://www.bbc.co.uk/news/world-middle-east- 
12301713. 
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During  the  protests  social  media  played  two  major  roles.  The  first  is  that  the  protestors 
used  social  media  to  stay  informed  of  ongoing  events  and  the  government’s  reaction  to  the 
protest  activity.  The  second  and  more  important  role  was  that  social  media  was  used  to  relay 
information  to  the  outside  world  on  events  within  Egypt. 

During  the  demonstrations  the  protest  organizers  used  social  media,  specifically  Twitter 
and  to  a  lesser  extent  Facebook,  to  provide  real-time  updates  to  other  activists  and  protest 
leaders.  Twitter  provided  updates  on  protest  activity,  identified  the  security  force’s  response  and 
discussed  protest  organizational  issues.  In  Christopher  Wilson’s,  an  analyst  at  the  UNDP  Oslo 
Governance  Centre,  and  Alexander  Dunn’s,  an  analyst  at  the  Cairo  Institute  for  Human  Rights 
Studies,  analysis  on  Twitter  use  during  the  protests,  the  authors  identified,  “that  Twitter  use  by 
Egyptians  coordinating  protest  communications  was  deliberate  and  well  considered.”  The 
protests  organizers  relied  on  Twitter  to  better  facilitate  the  protests  and  keep  other  Egyptians 
informed  of  events.  However,  when  interviewed,  individual  protesters  stated  that  they  relied 
more  on  face  to  face  communication  or  phone  calls  rather  than  social  media  when 
communicating  during  the  protests.26  Wilson  and  Dunn’s  study  highlight  the  importance  of 
social  media  in  organizing  events,  but  downplays  its  impact  when  measuring  the  individual 
protestors’  use  of  social  media. 

Social  media’s  largest  impact  was  in  the  international  environment.  The  tweets, 

27 

Facebook  updates,  and  YouTube  videos  kept  the  world  informed  of  events  in  Tahrir  square. 
Mainstream  media  sources  relied  on  social  media  to  understand  the  protests  and  to  disseminate 


25  Christopher  Wilson  and  Alexandra  Dunn,  “Digital  Media  in  the  Egyptian  Revolution:  Descriptive  Analysis  from  the  Tahrir  Data  Sets,” 
International  Journal  of  Communication,  Volume  5  (2011),  1250,  accessed  April  23,  2013,  http://ijoc.org. 

26  Ibid.,  1259. 

27  Blake  Hounshell,  “The  Revolution  Will  Be  Tweeted:  Life  in  the  Vanguard  of  the  Twitter  proletariat,  ‘  Foreign  Policy ,  July/ August  2011, 
accessed  April  26,  2013,  http://www.foreignpolicy.com/articles/2011/06/20/the_revolution_will_be_tweeted. 
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information  to  their  viewers  and  readers  elsewhere  in  the  world.  Social  media  kept  the  story  of 
the  protest  alive  and  the  first  person  narrative  that  social  media  provided  enabled  the 
international  audience  to  put  a  human  face  on  the  protests. 

Events  in  Egypt  demonstrate  why  a  CCDR  and  his  J2  should  exploit  social  media  to 
better  understand  their  AOR  and  provides  several  observations  that  a  J2  should  consider  when 
exploiting  social  media. 

The  first  observation  is  that  the  source  of  information  is  not  necessarily  important,  rather 
it  is  the  impact  of  that  information  when  it  is  further  disseminated  or  in  social  media  terms  goes 
viral.  Initially,  the  photos  of  Khalid  Said’s  dead  body  did  not  create  an  effect  until  Ghomin 
created  his  Facebook  page  which  expanded  the  audience  for  Said’s  story.'  Thus,  a  J2  should 
focus  on  tracking  viral  events  rather  than  identifying  the  origins  of  an  event. 

The  second  observation  is  that  social  media  is  an  international  capability,  thus  a  J2  must 
look  beyond  a  specific  country’s  borders  when  exploiting  social  media.  Ghomin  lived  in  Dubai 
when  he  built  the  Facebook  page  dedicated  to  Said,  highlighting  the  international  impact  of 
social  media.  Social  media  allows  individuals  to  impact  a  state  without  actually  living  in  that 
state.  A  J2  should  not  discount  the  impact  of  outside  influences  when  analyzing  social  media. 

A  third  observation  is  that  while  social  media  was  a  tool  of  the  protest  movement,  it  was 
not  the  sole  method  that  unified  the  protesters.  In  a  survey  of  protesters  conducted  by  Zeynep 
Tufekci,  a  University  of  North  Carolina  Sociologist,  and  Christopher  Wilson,  the  co-founder  of 
the  Engine  Room  a  technology  and  advocacy  research  group,  only  28.3%  heard  about  the 
protests  solely  through  Facebook,  while  48.4%  heard  about  the  protests  from  face  to  face 


28  Gilad  Lotan,  Erhardt  Graeff,  Mike  Ananny,  Devin  Gaffney,  Ian  Pearce  and  Danah  Boyd,  “The  Revolutions  Were  Tweeted:  Information  Flows 
During  the  2011  Tunisian  and  Egyptian  Revolutions,”  International  Journal  of  Communication,  Volume  5,  201 1,  1400,  accessed  April  23, 
2013,  http://ijoc.org  . 

29  Vargas,  “Spring  Awakening:  How  an  Egyptian  Revolution  Began  on  Facebook.” 

30  Preston,  “Movement  Began  with  Outrage  and  Facebook  Page  That  Gave  it  an  Outlet.” 
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communication.  This  data  highlights  how  social  media  was  an  important  factor  in  galvanizing 
the  protestors,  but  was  not  the  sole  or  even  most  important  factor.  Other  social  factors,  such  as 
existing  resistance  groups  and  person  to  person  communication,  cannot  be  ignored  when 
analyzing  the  impact  of  social  media  on  state  security.  As  with  all  sources  of  intelligence  social 
media  cannot  be  used  as  a  single  source,  rather  it  needs  to  be  combined  with  other  sources  of 
intelligence  to  paint  an  accurate  picture. 

The  fourth  observation  is  that  the  exploitation  of  social  media  may  only  provide  a  small 
snapshot  of  activities.  The  protest  organizers  relied  heavily  on  social  media  to  orchestrate  the 
protests,  however  as  discussed  above,  individual  protesters  did  not  rely  on  social  media  to  guide 
their  activities  during  the  protests.  This  highlights  that  the  exploitation  of  social  media  may  only 
provide  insight  into  a  small  subset  of  a  population,  such  as  the  organizers  of  an  event,  and  that 
social  media  may  not  tell  the  full  story  since  it  may  fail  to  capture  the  feelings  or  thoughts  of  the 
masses. 

The  final  observation  from  this  case  and  the  most  compelling  reason  for  a  J2  to  monitor 
and  exploit  social  media  is  to  gain  real  time  information  on  events.  The  textual  reports,  pictures 
and  videos  of  events  enable  the  J2  to  get  a  better  picture  of  a  situation,  adding  to  the  overall 
assessment.  Combining  social  media  data  with  other  intelligence  sources  will  provide  a  more 
holistic  picture  of  an  event,  keeping  the  CCDR  informed  on  changing  conditions  within  a 
country. 

The  Egyptian  revolution  highlights  how  social  media  was  used  to  influence  events  and 
relay  time  critical  information.  Social  media  was  used  to  ignite  the  protests,  continue  the 
protests  momentum  and  to  keep  the  world  informed  of  events  in  Egypt.  This  case  illustrates  why 

31  Zeynep  Tufekci  and  Christopher  Wilson,  "Social  Media  and  the  Decision  to  Participate  in  Political  Protest:  Observations  From  Tahrir  Square,” 
Journal  of  Communication,  Volume  62,  Issue  2  (March  6,  2012),  370,  accessed  April  25,  2013, 
http://onlinelibrary.wiley.eom/doi/10.l  1 1  l/j.l460-2466.2012.01629.x/pdf. 
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a  J2  needs  to  be  concerned  with  monitoring  and  exploiting  social  media  and  offers  some 


observations  at  which  the  J2  should  be  aware.  Now  that  the  what  and  why  has  been  answered,  it 
is  time  to  analyze  how  a  J2  should  exploit  social  media. 

How  to  exploit  Social  Media? 

A  J2  should  use  social  media  in  a  similar  fashion  as  he  uses  other  intelligence  sources, 
however  he  must  recognize  the  unique  attributes  of  information  exploited  through  social  media. 
This  section  will  explore  how  a  J2  can  exploit  social  media.  First,  is  a  discussion  on  how  and 
why  the  J2  should  write  intelligence  requirements  and  indication  and  warning  (I&W)  indicators 
that  social  media  can  answer.  Second,  follows  a  discussion  on  how  a  J2  can  identify  the  social 
media  platforms  to  exploit  and  add  to  a  collection  plan.  Finally,  the  section  will  conclude  with  a 
discussion  on  who  should  analyze  social  media  within  the  Intelligence  community  (IC). 

The  first  step  in  exploiting  social  media  is  to  ask  the  proper  questions.  The  Joint 
planning  process  uses  Critical  Information  Requirements  (CCIRs)  and  its  subset  Priority 
Intelligence  Requirements  (PIRs)  to  ask  questions  that  concern  the  operating  environment.  This 
process  begins  when  a  CCDR  establishes  CCIRs,  which  are  the  overarching  information 
requirements  that  a  CCDR  has  within  his  AOR.  CCIRs  are  designed  to  keep  the  CCDR 
informed  of  activities  and  actions  within  his  AOR  that  may  impact  his  theater  campaign  plan  or 
specific  operational  plans.  PIRs  are  questions  that  answer  gaps  in  understanding  of  the  adversary 
or  operational  environment.  PIRs  are  often  military  focused,  however,  to  understand  factors 
that  concern  stability  issues,  CCDRs  must  ensure  PIRs  encompass  socio-economic  issues  such  as 
political  stability,  economic  volatility  and  social  pressures. 


12  Chairman  of  the  Joint  Chiefs  of  Staff,  Joint  Publication  2-0:  Joint  Intelligence.  (Washington,  DC,  GPO,  June  22,  2007),  1-8. 
33  Ibid.,  1-8. 
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A  way  to  track  the  status  of  the  CCDR’s  CCIRs  and  PIRs  is  to  establish  an  Indications 

and  Warning  (I&W)  system  for  an  area  of  interest.  JP  2.0  defines  I&W  as: 

Those  intelligence  activities  intended  to  detect  and  report  time- sensitive  intelligence 
information  on  foreign  developments  that  could  involve  a  threat  to  the  United  States  or 
allied  and/or  coalition  military,  political,  or  economic  interests  or  to  US  citizens  abroad. 

It  includes  forewarning  of  hostile  actions  or  intentions  against  the  United  States,  its 
activities,  overseas  forces,  or  allied  and/or  coalition  nations.34 

For  example,  the  PACOM  CCDR  might  have  an  I&W  system  that  tracks  the  stability  of  the 
North  Korean  government.  In  this  case,  the  I&W  system  would  not  only  track  military  matters 
but  would  also  factor  in  social,  economic  and  political  matters  in  order  to  assess  stability. 

I&W  is  built  around  a  system  of  indicators.  A  single  indicator  may  not  be  significant,  but 
when  combined  with  other  indicators  it  may  provide  warning  of  a  pending  crisis.  For  example, 
in  country  X  the  loading  of  weapons  at  an  ammo  depot  may  not  be  a  major  indicator  of  pending 
military  action.  However,  when  this  activity  occurs  at  the  same  time  that  all  military  leave  is 
canceled  this  might  indicate  that  country  X  is  a  step  closer  to  some  type  of  military  action. 

When  assessing  a  country’s  stability,  indicators  that  provide  insight  into  social,  economic 
and  political  factors  must  be  created.  As  the  J2  conducts  JIPOE  the  attributes  of  the  social, 
economic  and  political  system  will  be  identified.  These  attributes  can  then  be  broken  down  into 
indicators  that  contribute  to  the  overall  stability  of  a  particular  state.  Indicators  should  be  precise 
and  if  possible  measurable,  although  social,  economic  and  political  factors  normally  rely  more 
on  qualitative  analysis  more  than  a  quantitative  measure. 

Once  PIRs  and  an  I&W  indicator  list  are  created,  the  J2  must  build  a  collection  plan.  The 
collection  plan  should  identify  the  various  intelligence  sources  that  will  answer  PIRs  or 
indicators.  The  standard  collection  plan  includes  requests  for  imagery,  signals  intelligence  and  a 

34  Ibid.,  1-16 
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request  for  open  source  information.  The  collection  plan  is  where  the  J2  should  identify  social 
media  as  a  source  of  intelligence.  To  effectively  target  social  media  the  J2  must  identify  the 
social  media  platforms  that  are  used  in  a  particular  country;  specifically  identifying  those  that  are 
most  likely  to  contain  information  that  can  assist  with  answering  PIRs  or  indicators.  For 
example,  if  a  country  does  not  have  a  large  percentage  of  individuals  who  use  Facebook,  then 
this  is  not  the  platform  that  the  J2  should  focus.  This  should  not  be  a  static  list;  it  should  be 
revisited  to  account  for  changing  social  media  habits,  new  platforms  and  new  devices  that  may 
cause  users  to  transition  to  new  platforms. 

To  assist  with  identifying  the  appropriate  social  media  platforms  to  collect  and  exploit, 
the  J2  should  examine  social  media  through  what  Anthony  Olcott,  an  expert  on  open  source 
intelligence,  calls  his  six  qualities  of  information;  volume,  velocity,  vector,  veracity,  verifiability, 

a  c 

and  vulgarity.  The  following  paragraphs  will  provide  a  brief  overview  of  Olcott’ s  qualities  of 
information  and  discuss  how  the  qualities  can  focus  the  collection,  exploitation  and  analysis  of 
social  media  platforms. 

The  first  quality  of  information  is  volume.  Olcott  writes  that  the  volume  of  information  is 
immense  and  grows  at  a  rapid  pace  every  single  day.36  Parsing  through  the  volume  of 
information  is  a  major  challenge  for  an  analyst,  making  it  difficult  to  identify  the  best  social 
media  platforms  to  target.  The  large  volume  of  information  suggests  that  the  majority  of  the 
information  found  on  social  media  is  probably  not  relevant  to  answering  a  PIR  or  indicator, 
making  it  difficult  to  focus  exploitation  efforts  due  to  limited  collection  and  analytical  capability. 

The  second  quality  of  information  is  velocity  which  concerns  the  speed  at  which 
information  is  produced  and  disseminated.  Olcott  writes  that  a  consequence  of  velocity  is  that  the 


35  Olcott.  Open  Source  Intelligence  in  a  Networked  World,  103-125. 

36  Ibid..  104-105. 
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lines  between  producers  and  consumers  of  information  are  blurred.  These  lines  mean  that  the 
consumer  is  often  also  the  producer  of  the  information.  A  review  of  one’s  local  news  station 
illustrates  this  new  reality  when  the  news  station  will  highlight  a  newsworthy  event,  such  as  a 
traffic  accident,  using  video  shot  by  a  consumer.  The  speed  of  information  requires  a  J2  to  have 
the  ability  to  quickly  access  and  analysis  social  media  platforms  in  order  to  identify  information 
that  meets  the  criteria  for  answering  a  PIR  or  indicator. 

To  best  address  volume  and  velocity  a  J2  needs  to  prioritize  social  media  exploitation 
against  those  platforms  that  provide  the  most  relevant  information  to  answer  PIRs  or  indicators. 
The  J2’s  collection  plan  should  include  collection  periodicity  and  identify  how  often  a  site 
should  be  analyzed  to  ensure  that  information  is  passed  in  a  timely  manner.  This  will  ensure  that 
only  the  most  relevant  social  media  platforms  are  exploited. 

The  next  three  characteristics  are  closely  related;  vector,  veracity  and  verifiability.  Olcott 
writes  that  the  vector  (or  flow)  of  information  has  changed  from  a  top-down  approach  to  a 

oo 

system  where  anyone  from  bottom  to  top  can  produce  information.  With  everyone  producing 
information  it  becomes  very  difficult  to  determine  the  veracity  of  information  and  to  determine 

on 

whether  or  not  the  information  is  verifiable.  These  characteristics  are  not  new  to  intelligence. 
For  example,  human  intelligence  analysts  must  always  validate  a  source  to  determine  whether  or 
not  a  source’s  information  is  true  and  verifiable. 

The  J2  must  factor  in  these  three  characteristics  when  conducting  JIPOE  on  social  media 
platforms  to  determine  which  platforms  to  target.  It  is  critical  to  understand  the  vector  in  order  to 
identify  who  runs  a  platform  and  who  provides  information  via  that  platform.  For  example,  a 
government  run  social  media  platform  may  not  be  useful  for  answering  indicators  that  address 

37  Ibid.,  110-112. 

38  Ibid..  114. 

39  Ibid..  116-117. 
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social  stability  issues  since  the  site  will  likely  contain  pro-govemment  information.  At  the  same 
time,  a  platform  run  by  dissidents  may  contain  a  large  amount  of  false  information  in  order  to 
help  justify  their  cause,  distorting  the  true  feelings  of  the  masses.  Additionally,  once  social 
media  information  is  collected,  an  analyst  must  also  factor  in  the  vector  to  determine  the  value  of 
the  information.  If  there  is  a  question  on  the  veracity  of  a  given  piece  of  information  it  may 
falsely  activate  an  indicator.  However,  information  does  not  have  to  be  true  to  cause  an  effect. 
This  creates  even  more  challenges  for  the  J2  since  information  that  is  known  to  be  false  may  still 
cause  instability. 

The  final  characteristic  of  information  is  that  it  has  become  more  vulgar.  Olcott  defines 
vulgar  as  “low,  common  and  prurient.”40  He  writes  that  the  ease  of  producing  and  consuming 
information  means  that  the  large  majority  of  information  that  exists  today  can  be  classified  as 
vulgar.41  The  majority  of  vulgar  information  is  irrelevant  to  answering  a  J2’s  questions.  The 
positive  aspect  of  the  amount  of  vulgar  information  is  that  once  a  platform  has  been  identified  as 
containing  mostly  vulgar  information,  such  as  social  media  platform  devoted  to  knitting,  a  J2  can 
eliminate  the  need  to  monitor  that  site.  The  negative  is  that  in  a  period  leading  up  to  a  crisis  or 
during  a  crisis  a  vulgar  site  devoted  to  knitting  may  quickly  become  the  opposition’s 
communication  method.  Thus,  the  J2  needs  to  periodically  review  the  list  of  vulgar  social  media 
platforms  to  ensure  that  they  are  not  being  used  for  different  purposes  than  previously  identified. 

After  using  Olcott’ s  six  characteristics  of  information  to  identify  and  prioritize  social 
media  platforms  that  should  be  exploited,  the  next  step  is  to  task  the  collectors  and  analysts 
within  the  J2  or  the  broader  Intelligence  Community.  A  typical  J2  has  limited  capacity  to  fully 
exploit  and  analyze  social  media  platforms.  Some  work  will  be  possible  such  as  keyword 


40  Ibid..  120. 

41  Ibid..  121-122. 
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searches  or  when  automated  systems  are  built  to  identify  relevant  information,  but  it  is  unlikely 
that  a  J2  will  have  the  organic  ability  to  adequately  analyze  social  media.  To  understand  social 
media  an  analyst  must  understand  the  language  and  culture  of  the  targeted  audience.  For 
example,  a  Syrian  using  Twitter  is  likely  writing  in  Arabic,  while  using  colloquialisms  that  may 
only  be  used  in  tweets.  This  makes  it  difficult  for  an  analyst  to  discern  easily  what  is  being  said 
without  knowing  how  Syrians  communicate  on  Twitter.  For  this  reason  the  analysis  of  social 
media  will  have  to  occur  outside  of  the  J2,  likely  within  the  greater  IC  where  analysts  have  the 
cultural  knowledge  to  appropriately  analyze  the  information.  A  possible  location  is  the  CIA’s 
Open  Source  Center  (OSC).  “  If  the  OSC  is  already  overtasked,  a  CCDR  may  need  to  utilize 
private  contractors  or  academic  organizations  to  evaluate  social  media,  particularly  in  areas  that 
may  not  be  a  high  priority  to  US  interests  but  meet  a  valid  concern  for  a  CCDR  to  monitor. 
Conclusion  and  Recommendations 

Each  month  more  and  more  people  are  accessing  social  media  platforms  in  order  to 
create,  disseminate  and  access  information.  The  proliferation  of  devices  means  that  in  the  future 
it  is  likely  that  social  media  platforms  will  be  the  primary  source  for  most  people  to  access 
information,  particularly  in  countries  that  do  not  have  a  robust  mainstream  media  access.  The 
importance  of  social  media  is  not  diminishing,  it  is  only  increasing,  and  thus  a  CCDR  has  a 
vested  interest  in  exploiting  social  media  in  order  to  better  understand  his  operating  environment. 

The  case  of  the  Egyptian  revolution  illustrates  how  social  media  was  used  as  a  tool  to 
rally  individuals  to  support  anti-Mubarak  protests.  Social  media  platforms  helped  to  organize  the 
opposition  and  kept  the  world  involved  through  real  time  updates.  The  case  demonstrates  how  a 
J2  can  exploit  social  media  to  better  understand  stability  issues.  If  the  CCDR  had  an  active  social 

42  Open  Source  Center  description,  CIA,  accessed  April  27,  2013,  https://www.cia.gov/library/publications/additional-publications/the-work-of-a- 
nation/cia-director-and-principles/centers-in-the-cia.htm. 
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media  monitoring  program  during  the  Arab  Spring  then  the  J2  may  have  had  a  better  grasp  on 
the  growth  of  the  opposition  movements  and  better  assessed  the  impact  of  the  protest 
movements. 

Within  a  CCDR’s  staff,  the  J2  has  the  responsibility  to  identify,  collect,  exploit  and 
analyze  information  from  social  media  platforms  to  inform  the  CCDR’s  situational  awareness. 
The  CCDR  must  ensure  he  has  PIRs  that  cover  social,  economic  and  political  issues.  These 
factor  space  issues  that  concern  the  population  are  often  difficult  to  collect  via  traditional 
intelligence  but  easy  to  answer  with  a  robust  social  media  collection  and  analysis  plan. 
Additionally,  a  J2  must  integrate  social  media  input  into  an  I&W  program.  The  JIPOE  process 
must  identify  which  social  media  platforms  should  be  exploited,  followed  by  building  a  robust 
collection  plan.  Finally,  the  J2  must  conduct  both  in-house  and  outsourced  exploitation  and 
analysis  of  social  media.  A  J2  must  think  through  the  process  described  above,  in  order  to 
effectively  identify  and  exploit  the  appropriate  social  media  platforms  that  best  answer  PIRs  and 
indicators.  These  answers  will  provide  a  CCDR  with  a  more  concise  picture  of  a  state’s  stability, 
allowing  him  to  better  shape  his  AOR. 
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